Stack-based buffer overflow in editorconfig-core-c - CVE-2024-53849

Vulnerability identifier: #VU101180

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-53849

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling untrusted input. A remote attacker can trick the victim into opening a specially crafted file, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

editorconfig-core-c
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Development Tools Module
openSUSE Leap
Ubuntu
editorconfig (Ubuntu package)
libeditorconfig0 (Ubuntu package)
editorconfig-core-c-debugsource
libeditorconfig0
libeditorconfig0-debuginfo
editorconfig-debuginfo
editorconfig
libeditorconfig-devel
libeditorconfig0-32bit
libeditorconfig0-32bit-debuginfo
libeditorconfig-devel-32bit
libeditorconfig-devel-64bit
libeditorconfig0-64bit-debuginfo
libeditorconfig0-64bit

Install updates from vendor's website.

editorconfig-core-c - update to 0.12.7
editorconfig (Ubuntu package) - addressed in versions Ubuntu Pro, 0.12.1-1.1+deb11u1build0.20.04.1
libeditorconfig0 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.12.1-1.1+deb11u1build0.20.04.1
editorconfig-core-c-debugsource - update to 0.12.6-150600.3.3.1
libeditorconfig0 - update to 0.12.6-150600.3.3.1
libeditorconfig0-debuginfo - update to 0.12.6-150600.3.3.1
editorconfig-debuginfo - update to 0.12.6-150600.3.3.1
editorconfig - update to 0.12.6-150600.3.3.1
libeditorconfig-devel - update to 0.12.6-150600.3.3.1
libeditorconfig0-32bit - update to 0.12.6-150600.3.3.1
libeditorconfig0-32bit-debuginfo - update to 0.12.6-150600.3.3.1
libeditorconfig-devel-32bit - update to 0.12.6-150600.3.3.1
libeditorconfig-devel-64bit - update to 0.12.6-150600.3.3.1
libeditorconfig0-64bit-debuginfo - update to 0.12.6-150600.3.3.1
libeditorconfig0-64bit - update to 0.12.6-150600.3.3.1

• https://github.com/editorconfig/editorconfig-core-c/commit/4d5518a0a4e4910c37281ab13a048d0d86999782
• https://github.com/editorconfig/editorconfig-core-c/commit/a8dd5312e08abeab95ff5656d32ed3cb85fba70b
• https://github.com/editorconfig/editorconfig-core-c/pull/103
• https://github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-475j-wc37-6274

• Remote code execution in editorconfig-core-c library
• SUSE update for editorconfig-core-c
• Ubuntu update for editorconfig-core